This Privacy Policy explains how The Scaling Company, a Delaware corporation doing business as Viro (“Viro”, “we”, “us”, or “our”), handles personal information. It covers our website at meetviro.com, the Viro platform and its apps, browser extensions, integrations, and messaging channels (together, the “Platform”), and our marketing.
1. Our Two Roles
Where we are the controller. We decide how and why personal information is used for our own accounts, billing, website, marketing, support, and security. This Policy governs that information.
Where we are the processor. When our customers use Viro, they decide what data goes into it, such as meeting recordings, emails, calendars, and contacts. We process that data on their behalf under our Data Processing Agreement. If you met with or were contacted by a Viro customer, that customer is responsible for your information, and our Meeting Participant Notice explains what that means for you. We describe this processing below so customers and the people they work with understand how it works.
2. Information We Collect
2.1 Information You Give Us
- Account information: name, work email, company, role, password, and preferences, including your communication style settings for Iris.
- Billing information: billing contact and address. Card details are collected and stored by our payment provider, Stripe. We don’t store full card numbers.
- Communications: messages you send us, support requests, feedback, and survey answers.
- Waitlist and marketing sign-ups: your email address and any details you choose to give.
2.2 Information From Connected Services
When a customer connects accounts to Viro, we process data from them on the customer’s behalf:
- Email: messages, threads, attachments, and contact details from connected email accounts, such as Gmail.
- Calendar: events, attendees, times, descriptions, and meeting links.
- Previous CRM: contacts, companies, deals, notes, and activity history imported when a customer moves to Viro.
- Messaging channels: messages and voice memos a customer sends to Iris, for example through iMessage, WhatsApp, Slack, or email.
- Phone systems: call details and, where a customer enables it, call recordings and transcripts.
2.3 Meeting Information
When a customer chooses Copilot, Proxy, or Ghost mode for a meeting, we process meeting audio, transcripts, participant names and email addresses, meeting chat messages, and the notes, summaries, and actions created from them. In Unassigned mode, we capture nothing. [Viro does not use meeting audio to create voiceprints or other biometric identifiers.]
2.4 Information Collected Automatically
We collect device and usage information such as IP address, browser and device type, pages and features used, timestamps, and error logs. On our website we use cookies and similar technologies, described in Section 11.
3. How We Use Information
As controller, we use personal information to:
- create and manage accounts, process payments, and provide the Platform;
- provide support and communicate with you about your account, security, and changes to our terms;
- send product updates and marketing, where permitted, with an opt-out in every message;
- monitor, secure, and improve the Platform, prevent fraud and abuse, and fix problems;
- comply with legal obligations and enforce our terms.
As processor, we use customer data only to provide the Platform to that customer, including preparing for meetings, taking notes, drafting and sending messages, updating records, and personalizing drafts to the customer’s writing style, as the customer instructs through its settings.
4. AI and Your Data
Viro uses AI models from third-party providers to power Iris, Nike, and other AI features.
- We do not use customer data, including meeting recordings, transcripts, email, and calendar content, to train or improve AI models, whether our own or a third party’s.
- We require our AI model providers not to use this data for training.
- Learning a customer’s writing style and preferences happens within that customer’s account and is not shared with other customers.
Our AI Disclosure and Acceptable Use Policy explains how our AI features work and their limitations.
5. Google User Data
When you connect a Google account, we access only the Google data needed for the features you use, such as reading and sending email and reading and managing calendar events. We use it only to provide and improve user-facing features of the Platform. We do not use it to serve advertising, do not sell it, and do not use it to train AI models. Our staff do not read it unless you give us permission for a specific purpose, it is necessary for security, or the law requires it.
Viro’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Legal Bases (EEA, UK, and Switzerland)
Where data protection law in the EEA, UK, or Switzerland applies to our role as controller, we rely on these legal bases:
- Contract: to provide the Platform and manage your account and billing.
- Legitimate interests: to secure and improve the Platform, prevent abuse, and market to business contacts where the law allows. We balance these interests against your rights.
- Consent: for non-essential cookies and certain marketing. You can withdraw consent at any time.
- Legal obligation: to keep tax records and respond to lawful requests.
7. How We Share Information
We share personal information only as follows:
- Service providers (subprocessors) who help us run the Platform, such as hosting, AI model, transcription, meeting capture, email delivery, analytics, and payments, under written data protection terms. Our Subprocessor List names them.
- Connected services you choose, such as when Viro sends an email from your account or updates your calendar.
- Legal and safety reasons: to comply with law or valid legal process, or to protect rights, safety, and security.
- Business transfers: to a successor or affiliate in a merger, acquisition, reorganization, spin-off, or sale of assets, under protections at least as strong as this Policy.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
8. Retention
We keep personal information only as long as needed for the purposes above:
- Account information: for the life of the account, then for a limited period to handle billing, disputes, and legal requirements.
- Customer data: for the life of the subscription. After it ends, the customer has 30 days to export it, after which we delete it. Customers can delete individual recordings, transcripts, and records at any time.
- Billing and tax records: as long as tax law requires.
- Marketing data: until you unsubscribe, plus a record of your opt-out so we can respect it.
- Backups: deleted as backups are overwritten in the normal course.
9. International Transfers
We are based in the United States, and our team and service providers may process personal information in other countries, including [the United States, the United Kingdom, and Nigeria]. When we transfer personal information from the EEA, UK, or Switzerland to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism.
10. Security
We use technical and organizational measures appropriate to the risk, including encryption in transit, encryption at rest through our infrastructure providers, access controls limited to personnel who need access, and multi-factor authentication for administrative access. No system is perfectly secure. If a breach affects your personal information, we will notify you and regulators as the law requires.
11. Cookies
We use cookies that are strictly necessary to run our website and Platform. With your consent where the law requires it, we also use analytics cookies to understand how the website is used. You can manage cookies through our cookie banner, where shown, and your browser settings. Blocking necessary cookies may stop parts of the website from working.
12. Your Rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to opt out of marketing. To exercise these rights, email legal@meetviro.com. We will verify your request and respond within the time the law requires. We will not discriminate against you for exercising your rights.
If your information is in a Viro customer’s account, such as a meeting you attended, we will pass your request to that customer and help them respond.
California residents: we do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information for purposes that require an opt-out. You may use an authorized agent to make a request.
EEA and UK residents may complain to their local data protection authority.
13. Children
The Platform is for business use by people aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact legal@meetviro.com and we will delete it.
14. Changes
We may update this Policy. If we make material changes, we will notify customers by email or in the Platform before they take effect and update the date above.
15. Contact
Questions or requests: legal@meetviro.com. The Scaling Company, 1111B South Governors Avenue, Dover, DE 19904.